{
  "preparedUTC": "2026-10-31T19:10:20.498230+00:00",
  "workingThesis": "The visible onchain operation used stolen proceeds and sponsored transactions. No independent pre-theft financier or real-world attacker identity has been established. The later split, bridges and mixer test fit a cashout/concealment strategy; that motive is an inference.",
  "scope": "Verified major funding/proceeds milestones plus 12 newly sampled balances. This is a curated index, not every token event or all assets. Historical proof links retain their own cutoffs.",
  "addresses": {
    "collector": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
    "E4": "0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6",
    "539": "0x5392587814ce8c6af6789764f88e5e9ab0b9962c",
    "C91": "0xc91ee0574a14446de200923729c349b9cae19b60",
    "routing3f701": "0x3f7019221a925537dc20767c38e80a7127fb1ffa",
    "E5": "0xe5e76a4d73f3bfb5cc9a8f53d4f8459fcac495f6",
    "passThrough74": "0x74e940e4eb470a9d8b78c5eb8919938041219897",
    "swapForward9ab": "0x9ab3c17b1a37886f1d702945fcf8016e3e549b18",
    "sellingAccount": "0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b",
    "sellingSigner": "0x0543635ef8e7981c4885fcfc187bc8564481ef74"
  },
  "majorMovements": [
    {
      "kind": "firstVerifiedCollectorFunding",
      "UTC": "2026-10-29T17:10:23Z",
      "chain": "Polygon",
      "to": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
      "asset": "POL",
      "amount": "1957.062835268601520992",
      "tx": "0x896e4b56ab0142a6b3bf16c029a7f139e64bc3fc2c6b99c7f949d31cb6172e47",
      "economicSource": "Victim-conversion flow, not an independently identified external seed.",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-origin-20261031T1500/origin/ORIGIN-ROLE-BOUNDARY.json"
    },
    {
      "kind": "collectorSplit",
      "UTC": "2026-10-29T18:28:32Z",
      "chain": "Polygon",
      "from": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
      "to": "0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6",
      "asset": "POL",
      "amount": "18613584",
      "tx": "0x2629289569ea8be042b6706ba0a9e0d76f069247bb115f973fcedc556e8a4f88",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-extension-20261031T1740/collector-corpus/COLLECTOR-SIGNED-TRANSACTION-INDEX.json"
    },
    {
      "kind": "collectorSplit",
      "UTC": "2026-10-29T18:30:41Z",
      "chain": "Polygon",
      "from": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
      "to": "0x5392587814ce8c6af6789764f88e5e9ab0b9962c",
      "asset": "POL",
      "amount": "4295442",
      "tx": "0x69e1c3f6c3cc1cacbc145ba0a7b475532d0856522b112add36d4eeb5d84fc0c5",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-extension-20261031T1740/collector-corpus/COLLECTOR-SIGNED-TRANSACTION-INDEX.json"
    },
    {
      "kind": "collectorSplit",
      "UTC": "2026-10-29T18:38:16Z",
      "chain": "Polygon",
      "from": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
      "to": "0xc91ee0574a14446de200923729c349b9cae19b60",
      "asset": "POL",
      "amount": "5727258.445005680443738570",
      "tx": "0xe8b8ee79a0e507b88027506f4098cbbcab6557272fb59becc42b53574b3e9f66",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-extension-20261031T1740/collector-corpus/COLLECTOR-SIGNED-TRANSACTION-INDEX.json"
    },
    {
      "kind": "onwardProceeds",
      "UTC": "2026-10-29T18:30:34Z",
      "chain": "Polygon",
      "from": "0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6",
      "to": "0x3f7019221a925537dc20767c38e80a7127fb1ffa",
      "asset": "POL",
      "amount": "1094091.90371991",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-funding-thesis-20261031T1855/historical/polygon-native-ledger-summary.json",
      "tx": "0x269f47684f7c88a157df151ef48d2abd9aef5b66f4716cae3a3a65567a1c9bcd"
    },
    {
      "kind": "onwardProceeds",
      "UTC": "2026-10-29T18:35:59Z",
      "chain": "Polygon",
      "from": "0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6",
      "to": "0x3f7019221a925537dc20767c38e80a7127fb1ffa",
      "asset": "POL",
      "amount": "2188183.80743982",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-funding-thesis-20261031T1855/historical/polygon-native-ledger-summary.json",
      "tx": "0x56936d41de696cd0120c22a2478656be9af1673c6d1a76fdd55c1e0b9ae50881"
    },
    {
      "kind": "ethereumConsolidation",
      "UTC": "2026-10-29T18:47:47Z",
      "chain": "Ethereum",
      "from": "0x74e940e4eb470a9d8b78c5eb8919938041219897",
      "to": "0xe5e76a4d73f3bfb5cc9a8f53d4f8459fcac495f6",
      "asset": "ETH",
      "amount": "19.32951879",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/direct-link-20261031T0519/attacker-origin/74E9-ORIGIN-CONTROL-VERIFIED.json"
    },
    {
      "kind": "ethereumConsolidation",
      "UTC": "2026-10-29T18:48:11Z",
      "chain": "Ethereum",
      "from": "0x3f7019221a925537dc20767c38e80a7127fb1ffa",
      "to": "0xe5e76a4d73f3bfb5cc9a8f53d4f8459fcac495f6",
      "asset": "ETH",
      "amount": "85.08041818",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/optimism-avalanche-provenance.json"
    },
    {
      "kind": "ethereumConsolidation",
      "UTC": "2026-10-29T19:35:35Z",
      "chain": "Ethereum",
      "from": "0x9ab3c17b1a37886f1d702945fcf8016e3e549b18",
      "to": "0xe5e76a4d73f3bfb5cc9a8f53d4f8459fcac495f6",
      "asset": "ETH",
      "amount": "21.686738689426539852",
      "proofURL": "https://polymarket-drain-trace.pages.dev/proof/optimism-avalanche-provenance.json"
    },
    {
      "kind": "confirmedMixerEntry",
      "UTC": "2026-10-29T20:02:23Z",
      "chain": "Ethereum",
      "from": "0xc91ee0574a14446de200923729c349b9cae19b60",
      "asset": "ETH",
      "amount": "0.1",
      "service": "Tornado Cash router to the 0.1 ETH pool",
      "tx": "0xf22655c135c2f44df2a76ffe3d891b7dd4ce0253bf7ce671f90adde04da3f002",
      "proofURL": "https://etherscan.io/tx/0xf22655c135c2f44df2a76ffe3d891b7dd4ce0253bf7ce671f90adde04da3f002",
      "withdrawalAttribution": "No particular withdrawal has been reliably linked to this deposit."
    }
  ],
  "collectorSplitTotalPOL": "28636284.445005680443738570",
  "C91RelayHistory": {
    "requests": 22,
    "filled": 19,
    "refunded": 3,
    "successfulRouteValuePOLApprox": "1490000",
    "interpretation": "Refunds and conversion payments are returns of previously sent value, not new financiers."
  },
  "sellingAccount": {
    "name": "gfg44433",
    "wallet": "0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b",
    "ownerKey": "0x0543635ef8e7981c4885fcfc187bc8564481ef74",
    "deploymentUTC": "2026-10-29T17:44:28Z",
    "role": "Received and sold stolen outcome shares. Gas-paying submitter and account owner are separate roles.",
    "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-origin-20261031T1500/origin/ORIGIN-ROLE-BOUNDARY.json"
  },
  "tradingPaymentsOut": {
    "to": "0xcd6b980029e6e6e0733ac8ec3e02be9410d09799",
    "USDC.e": "25.930784",
    "USDC": "15.801720",
    "separateExcessOutputRecipient": "0x3692dea4346c95eb3957d8022c40373ab2a21369",
    "excessPOL": "679.910591174725921613",
    "role": "Fee/referrer and excess-output payments. Neither role establishes attacker control of a receiving service address.",
    "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-extension-20261031T1740/collector-corpus/NEW-SERVICE-POINTERS.json"
  },
  "separateCommerceRoute": {
    "origin": "0x3f7019221a925537dc20767c38e80a7127fb1ffa",
    "EthereumAsset": "USDT",
    "amount": "1526.930000",
    "BaseAsset": "USDC",
    "BasePayer": "0x133243d447026345c2b368d7ffe435dbe3c566eb",
    "netReceiver": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
    "netUSDC": "1511.660700",
    "feeUSDC": "15.269300",
    "interpretation": "The payment payer is a different recovered key; merchant/customer identity and attacker control are unestablished.",
    "laterPooledSweepUSDC": "2267.694000",
    "includedPriorFundsUSDC": "756.033300",
    "laterDestinationExplorerLabel": "Coinbase14; label is not a customer or KYC identification.",
    "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-origin-20261031T1500/payment-service/EXACT-ADDRESS-SERVICE-FINDINGS.json"
  },
  "latestSelectedHoldings": {
    "scope": "Twelve selected asset balances. Outcome shares and unlisted assets are excluded.",
    "holdings": [
      {
        "chain": "Ethereum",
        "label": "e4",
        "address": "0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6",
        "asset": "ETH",
        "amount": "0.3997874672242106",
        "asOfUTC": "2026-10-31T18:59:23+00:00"
      },
      {
        "chain": "Ethereum",
        "label": "c91",
        "address": "0xc91ee0574a14446de200923729c349b9cae19b60",
        "asset": "ETH",
        "amount": "58.333930583210084939",
        "asOfUTC": "2026-10-31T18:59:23+00:00"
      },
      {
        "chain": "Ethereum",
        "label": "e5",
        "address": "0xe5e76a4d73f3bfb5cc9a8f53d4f8459fcac495f6",
        "asset": "ETH",
        "amount": "126.096675659426539853",
        "asOfUTC": "2026-10-31T18:59:23+00:00"
      },
      {
        "chain": "Ethereum",
        "label": "3f",
        "address": "0x3f7019221a925537dc20767c38e80a7127fb1ffa",
        "asset": "ETH",
        "amount": "0.50824437123767711",
        "asOfUTC": "2026-10-31T18:59:23+00:00"
      },
      {
        "chain": "Ethereum",
        "label": "3f",
        "address": "0x3f7019221a925537dc20767c38e80a7127fb1ffa",
        "asset": "USDT",
        "amount": "21.517025",
        "asOfUTC": "2026-10-31T18:59:23+00:00"
      },
      {
        "chain": "Polygon",
        "label": "e4",
        "address": "0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6",
        "asset": "POL",
        "amount": "15331308.312708954252254001",
        "asOfUTC": "2026-10-31T18:59:25+00:00"
      },
      {
        "chain": "Polygon",
        "label": "539",
        "address": "0x5392587814ce8c6af6789764f88e5e9ab0b9962c",
        "asset": "POL",
        "amount": "4295442.025",
        "asOfUTC": "2026-10-31T18:59:25+00:00"
      },
      {
        "chain": "Polygon",
        "label": "c91",
        "address": "0xc91ee0574a14446de200923729c349b9cae19b60",
        "asset": "POL",
        "amount": "4235982.756885163313955003",
        "asOfUTC": "2026-10-31T18:59:25+00:00"
      },
      {
        "chain": "Polygon",
        "label": "main",
        "address": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
        "asset": "POL",
        "amount": "0.025000048",
        "asOfUTC": "2026-10-31T18:59:25+00:00"
      },
      {
        "chain": "Polygon",
        "label": "secondary",
        "address": "0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b",
        "asset": "POL",
        "amount": "0",
        "asOfUTC": "2026-10-31T18:59:25+00:00"
      },
      {
        "chain": "Polygon",
        "label": "main",
        "address": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
        "asset": "USDC.e",
        "amount": "4127.739599",
        "asOfUTC": "2026-10-31T18:59:25+00:00"
      },
      {
        "chain": "Polygon",
        "label": "secondary",
        "address": "0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b",
        "asset": "pUSD",
        "amount": "4939.424699",
        "asOfUTC": "2026-10-31T18:59:25+00:00"
      }
    ]
  },
  "latestStateComparisonURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-funding-thesis-20261031T1855/current-state/STATE-VS-1813.json",
  "publicIndependentFundingConclusion": "No pre-theft sponsor has been established. The first verified collector credit was a victim conversion. This does not prove that obtaining the vendor compromise or other preparation cost nothing.",
  "unverifiedClaim": {
    "claim": "Polymarket attacker prefunded from three0.1ETH Tornado withdrawals",
    "status": "Not verified for this incident; separately retained Binance transactions must not be imported as Polymarket evidence.",
    "proofURL": "https://polymarket-drain-trace.pages.dev/proof/attacker-origin-20261031T1500/relayer-claim/RELAYER-CLAIM-CHECK.json"
  },
  "CarFundingLinkEstablished": false,
  "sourceCollections": {
    "all34CollectorTransactions": "https://polymarket-drain-trace.pages.dev/proof/attacker-extension-20261031T1740/collector-corpus/COLLECTOR-SIGNED-TRANSACTION-INDEX.json",
    "145FilePriorProofBundle": "https://polymarket-drain-trace.pages.dev/proof/attacker-extension-20261031T1740-evidence.zip",
    "fullPublishedArtifactHashes": "https://polymarket-drain-trace.pages.dev/SHA256.json",
    "newHoldings": "https://polymarket-drain-trace.pages.dev/proof/attacker-funding-thesis-20261031T1855/current-state/SELECTED-HOLDINGS.json"
  },
  "unknowns": [
    "Real-world identity or number of operators.",
    "Who obtained control of the malicious script-delivery path and how any preparation was paid for.",
    "Whether any earlier financing exists outside the mapped wallets.",
    "Unambiguous Tornado withdrawal destination and ultimate exchange customer identities."
  ]
}